Privacy Notice

NOTICE TO AUSTRALIA RESIDENTS

If you are a resident of Australia, the following information applies.

Definitions and Interpretation – This Notice to Australia Residents supplements and incorporates and should be read together with the information contained in our Privacy Notice to which this is attached. It provides additional information about our privacy practices in relation to our Australian-related activities.

If there is any conflict between the terms of this Notice to Australia Residents and the Privacy Notice, the terms of this Notice to Australia Residents will prevail. Otherwise, the terms of the Privacy Notice apply and are incorporated into this Notice to Australia Residents.

References to “personal data” in the Privacy Policy and “personal information” in this Notice to Australian Residents will, for the purposes of this Notice to Australian Residents, be taken to have the same meaning as “personal information” in the Australian Privacy Act 1988 (Cth) (the “Privacy Act”). References to “sensitive information” in this Notice to Australian Residents will have the same meaning as “sensitive information” in the Privacy Act. The Privacy Act and this Notice to Australia Residents do not differentiate between “controllers” and “processors” of personal information and apply irrespective of whether we would be considered a controller or processor under the Privacy Notice or any other privacy law. Where additional personal information or sensitive information not detailed in this Notice to Australia Residents is to be collected, we will provide you with a separate privacy collection notice (“PCN”) for that collection. Any such PCN is to be read together with this Notice to Australia Residents (and the Privacy Notice as incorporated into this Notice to Australian Residents) in relation to that collection.

Identity and Contact Information - The Topgolf Offerings are owned and operated by Topgolf International, LLC and our address is N. Central Expressway, Suite 1200 Dallas, U.S.A. TX 75231. If you have any questions, concerns, or comments about the Topgolf Offerings, please reach out by calling +1 (833) 554-0955 or writing to us at the following mailing address: Topgolf, Attn: Privacy Team, 8750 N. Central Expressway, Suite 1200 Dallas, U.S.A. TX 75231.

Collection Information – The way we collect your personal information and sensitive information, as well as the details of the type of information we collect is detailed in the Privacy Notice at Section 1.

Collection Consent – By providing us with your information of using our services you consent to our collection, use and disclosure of your sensitive information as detailed in this Notice to Australian Residents. The sensitive information we collect about you is your:

• Demographic Data. This may include your age, date of birth, sex and/or gender, marital status, zip code.
• Geolocation Data. This includes your precise location when this function has been turned on by you.
• Biometric Data. Where you chose to log in to our Apps using such means, your faceprint (for facial recognition), fingerprint and other biometric information.
• Government Identification. Such as your driver’s license number or other government-issued identifier.

This consent remains valid unless and until you notify us in writing of the withdrawal of your consent to our processing of your sensitive information. However, if you do withdraw your consent or if you do not provide us with the sensitive information requested for the relevant purpose(s), we will be unable to provide you with the relevant services for which we are seeking to collect, use and disclose your sensitive information.

Where you provide us with personal information about any other individual, you warrant that you have the authority of that individual to disclose such information and that you have referred that individual to the Privacy Notice and this Notice to Australia Residents regarding how we collect, use and disclose their personal information.

Where you provide us with sensitive information about any other individual, you warrant that you have the consent of that individual to disclose such information and that you have referred that person to the Privacy Notice and this Notice to Australia Residents and they consent to us collecting, using and disclosing the sensitive information in accordance with this Notice to Australia Residents until that consent is withdrawn by notifying them us in writing of the withdrawal of the consent to our processing of their sensitive information.

Likely Overseas Disclosure - Personal information we collect may be disclosed to overseas recipients that are located in the United States or any other country in which we or our subcontractors maintain facilities. We rely on your consent to facilitate this disclosure in the United States and other jurisdictions, where laws regarding processing of personal information may be less stringent than the Australian Privacy Principles. In certain cases, we may rely on appropriate safeguards such as standard contractual clauses as a basis for the overseas disclosure.

Your Rights to Access and Correct Your Personal information - You have the right to access and correct inaccuracies in your personal information in our custody and control, subject to certain exceptions prescribed by law. You also have the right to make complaints about our handling of your personal information as detailed below. You may request access and corrections of inaccuracies in your personal information we have in our custody or control by writing to us at the following mailing address: Topgolf, Attn: Privacy Team, 8750 N. Central Expressway, Suite 1200 Dallas, U.S.A. TX 75231. We may request certain personal information for the purposes of verifying the identity of the individual seeking access to their personal information.

Third Party Advertising. As discussed in the Privacy Notice at Sections 3 and 4 , we work with certain third party advertising companies in connection with our online advertising and those companies may set cookies or other tracking technologies in connection with providing advertising related services to us. Please refer to EDAA’s choice page at https://www.youronlinechoices.com to learn more about your choices related to advertising with respect to participating EDAA member companies.

Users Younger Than Age 16
Our Websites and Apps are directed to persons in Australia who are at least sixteen (16) years of age and we do not knowingly collect any personal data from children in Australia younger than the age of sixteen (16) years old.

If a parent or guardian in Australia is made aware that a child under the age of sixteen (16) years has provided us with their personal information through any point of contact, please call us at +1 (833) 554-0955 or write to us at the contact details below, and we will delete the personal information. If we have actual knowledge that personal information about a person in Australia younger than the age of sixteen (16) years old has been collected without parental/guardian consent we will take the appropriate steps to delete such personal information.

Protecting Your Information - The steps that we take to protect your personal information are those that are reasonable in the circumstances to protect the information from misuse, interference, loss and unauthorised access, modification or disclosure. These are more fully described in Section 7.

Complaints and Resolving Concerns - If you have any questions or comments about this Privacy Notice or if you otherwise have a question or complaints about the manner in which we or our service providers treat your personal data, you may contact us by writing to us at the following mailing address: Topgolf, Atn: Privacy Team, 8750 N. Central Expressway, Suite 1200 Dallas, U.S.A. TX 75231.

We will investigate your complaint, respond within a reasonable time and attempt to resolve it. If we cannot resolve your complaint to your satisfaction, you may submit your complaint online (OAIC Web Form) to the Office of the Australian Information Commissioner or by standard post or registered mail to GPO Box 5288, Sydney NSW 2001 or by fax to +61 2 6123 5145.

NOTICE TO INDIVIDUALS IN THE EUROPEAN ECONOMIC AREA/UNITED KINGDOM RESIDENTS

If you are located in the European Union (“EU”), in the European Economic Area (“EEA”) countries, or in the United Kingdom (“UK”), the following additional information applies in relation to the use and processing of your personal data under the General Data Protection Regulation (the “GDPR”), and the UK General Data Protection Regulation together with the UK Data Protection Act (the “UK GDPR”).

OUR ROLE IN THE PROCESSING PERSONAL DATA

Topgolf and its corporate affiliates
The Topgolf corporate affiliate that you interact with is, as a starting point, the controller of your personal data.

However, where Topgolf and its relevant corporate affiliates work together and collaborate for the purposes outlined in the Privacy Notice, we are joint controllers and jointly responsible for the processing of your personal data. Topgolf and its corporate affiliates have entered into a joint controllership arrangement to allocate the responsibility between the companies to ensure the protection of your personal data when the relevant corporate affiliates are jointly responsible for the processing of your personal data. You have the right to receive information on the essence of this arrangement. If you wish to receive further information, please contact us on the contact details outlined in Section 12 (Contact Us) above. A list of the Topgolf corporate affiliates covered by this information is included in the same section above.

Joint controllership with TTR Operators
TTR Operators are separate controllers and responsible for their own processing of your personal data for their own business purposes. However, for the processing of personal data to manage events and leaderboards in the Toptracer Range Management System, we and relevant TTR Operators are joint controllers. We have entered into a joint controllership arrangement with relevant TTR Operators in relation to this processing of personal data. If you wish further information regarding the essence of this arrangement, please contact us on the contact details outlined in Section 12 (Contact Us) above.

OUR USE OF PERSONAL DATA AND LEGAL BASIS

In the table below, we outline which categories of personal data we process and the legal basis for the processing in relation to the purposes for which we collect and process your personal data. The purposes for which we process your personal data in particular depend on, for example, how you interact with us and your relationship with us.

LEGAL BASIS FOR OUR DISCLOSURE OF PERSONAL DATA

As described in Section 3 (Our Disclosure of Personal Data) above, we provide third parties with certain personal data for the purposes outlined in the same section. In the table below, we explain which legal basis we rely on for sharing your personal data with these third parties. The third-party recipients outlined below are, unless otherwise is stated, responsible for their own subsequent use and processing of your personal data for their own purposes, including, where relevant, to send you information about their products and services.

RETENTION OF PERSONAL DATA

In addition to the information outlined in Section 8 (Retention and Destruction of Personal Data), please find below additional information regarding the criteria used to determine for how long we store your personal data.

• Active relationship: If we have an active relationship, for example if you actively use our Topgolf Offerings, we normally keep the personal data necessary to manage the relationship and your use of the Topgolf Offerings for as long as the relationship is active. In addition, game session information will be stored for as long as you use our Topgolf Offerings.
• Marketing: Provided that you have not opted out of our use of your personal data for marketing purposes, we normally keep your personal data for this purpose for as long as there is an active relationship with you.
• Comply with legal requirements: We keep your personal data for such period as is necessary to comply with legal obligations to which we are subject, for example accounting and bookkeeping requirements or to cooperate with a manage and defend legal claims: We normally keep your personal data for such period during which a legal claim can arise under law in order to manage and defend such legal claims.
• Manage specific activities that you participate in: If you participate in an event, contest, sweepstakes or a survey that we carry out, we normally keep your personal data to manage the activity for the duration of the activity as such. However, we will display your first and last name or username on leaderboards until further notice or until you opt out of this.
• Fulfill legitimate business needs: We also keep your personal data during such period as is necessary to fulfill specific legitimate business needs, for example to carry out research or analysis in which case the personal data used and collected is normally only processed for such period that is necessary to carry out the specific research or analysis and to compile a report with the result.
• Security: If necessary for security reasons, for example to investigate, detect, prevent, and protect against misuses of our systems, we will process your personal data stored in our systems for this purpose.
• Precise location services: If you have given your consent for us to use your location data, we only process and keep your location data to provide you with the specific feature or functionality that use your location data, for example to allow you to locate a Topgolf Location near you.
• Business transitions: If it is necessary to process your personal data as a part of a corporate transaction, we will keep and process your personal data for this purpose for as long as necessary to carry out the specific business transition.
• Cookies and similar technologies: For information on how long we store cookies, please see our cookie preference management tool or contact us using the contact details set out above, see Section 12 (Contact Us).

YOUR RIGHTS

Under the GDPR and the UK GDPR, you have certain rights in relation to the use and processing of your personal data, including the right to:

• Access to and obtain a copy of your personal data together with additional information about our processing of your personal data.
• Update (rectification) of or request that we supplement your personal data if you consider that your personal data is incorrect, incomplete, or misleading.
• Erasure of your personal data in certain situations. Please note that some of our Topgolf Offerings allow you to delete your user account directly in the service.
• Object to our processing of your personal data, for example our processing of your personal data for direct marketing purposes or when we rely on a legitimate interest as the legal basis for the processing. You can at any time opt-out of receiving digital direct marketing communications from us, for example by clicking the unsubscribe link at the bottom of any e-mail you receive from us. Certain Topgolf Offerings allow you to adjust your communication preferences directly in the service. Please note that even if you have opted out of receiving digital direct marketing communication we can still contact you and send you digital communication that is deemed to be transactional, for example regarding updates to our policies and terms and conditions for the use of Topgolf Offerings.
• Request that our processing of personal data is restricted in certain situations, which means that you can, at least for a certain period, prevent us from processing your personal data (other than storing your personal data).
• Receive a copy of the personal data that you have provided to us in a structured and commonly used format and, where it is technically feasible, request that the personal data is transferred directly to an external recipient (data portability).
• Withdraw your consent to the processing of personal data based on your consent (without affecting the lawfulness of the processing carried out based on your consent before the withdrawal).
• Lodge a complaint with your supervisory authority. Contact details for national supervisory authorities in the EU are available here. In the UK the supervisory authority is the Information Commissioner’s Office (ICO). Contact details to the ICO are available here.

Please note that certain rights only apply in certain situations, and that there are several exceptions to certain rights. As such, we may not always be able to comply with your request. Additionally, where a request is manifestly unfounded or excessive, we may choose to charge a reasonable fee to manage your request instead of refusing to act on the request. If for any reason we are unable to comply with your request, in whole or in part, we will inform you of this and the reason why we are unable to comply with your request. If you wish to exercise any of your rights, please contact us at the contact details set out above, see Section 12 (Contact Us). When you make a request to exercise your rights, we may need to ask you for additional information to verify your identity or to correctly find you in our systems. We only request the information that is reasonable and necessary for these purposes. We will respond to your request as soon as possible and normally within one (1) month of receiving your request. However, if your request is complex or if you have made multiple requests, we may need additional time to manage your request. In such a case, we will inform you of this and the reason for the extension no later than one (1) month from the date we received your request.

AUTOMATED INDIVIDUAL DECISION-MAKING

We do not use automated individual decision-making, including profiling, in a way that produces legal effects concerning you or otherwise significantly affects you.

INTERNATIONAL TRANSFERS OF PERSONAL DATA

As explained in Section 9 (Cross-Border Transfers of Data) above, your personal data will be transferred to Topgolf in the U.S. in connection with the use of our Topgolf Offerings. In addition, some of our affiliates are also located outside the UK/EEA/EU. Transfers to Topgolf in the U.S. and to our affiliates outside the UK/EEA/EU are governed by our intra group agreement, which includes the EU Commission’s standard contractual clauses for international transfers and a UK international data transfer agreement. In addition, our services providers, business partners and TTR Operators with whom you interact may be located outside of the UK/EEA/EU. In order to ensure an essentially equivalent level of protection for your personal data when transferred (or otherwise made available) to such recipients in third countries outside of the UK/EU/EEA, which do not provide an adequate level of protection, we normally rely on the EU Commission’s abovementioned standard contractual clauses for international transfers (in addition to, when needed, UK international data transfer agreements. In addition, where necessary – in light of the law and practices of the country of destination – we implement supplementary technical and contractual measures to ensure that your personal data is protected regardless of where it is processed.

We also rely on so-called adequacy decisions issued by the European Commission where personal data is transferred to countries and recipients covered by such decision, please see the European Commission’s website for more information on which countries that are covered by an adequacy decision. As an example, we rely on the EU-U.S. Data Privacy Framework for transfers to service providers in the U.S. that are certified under the framework, please see the framework website. For more information on the safeguards that we have taken to protect your personal data when we transfer personal data outside of the UK/EEA/EU, you may contact us at the contact details set out above, see Section 12 (Contact Us).

CHILDREN’S PRIVACY

Our Websites and Apps are directed to persons located in the UK/EEA/EU who are at least sixteen (16) years of age, and we do not knowingly collect any personal data from children in the UK/EEA/EU younger than the age of sixteen (16) years. If you are under the age of sixteen (16), you should not use our services or otherwise provide us with any personal data either directly or by other means. If a parent or guardian in the EEA is made aware that a child under the age of sixteen (16) years has provided us with personal data through any point of contact, please contact us using the contact details set out above, see Section 12 (Contact Us). If we have actual knowledge that personal data about a person in the EEA younger than the age of sixteen (16) years has been collected without parental/guardian consent, then we will take immediate and appropriate steps to delete such personal data.

COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar technologies in our Topgolf Offerings. Cookies which are strictly necessary to provide you with the Topgolf Offering do not require your prior consent. Functional cookies, analytical or performance cookies and targeting cookies are only used if you have provided your prior consent to the use of these cookies by using the opt-in mechanisms available in the relevant Topgolf Offering. Where your personal data is collected using cookies and similar technologies, the processing of your personal data is based on the consent that you provided to the use of cookies, please see the table in the section Our Use of Personal Data and Legal Basis above. You can always withdraw your consent to the use non-essential cookies and to the processing of your personal data collected using such cookies by adjusting your preferences in the relevant Topgolf Offering. Please note, however, that if you do not provide or withdraw your consent to the use of non-essential cookies, we may not be able to provide you with certain functionality or features in the relevant Topgolf Offering. In addition, you may still receive and be shown advertisements, but the advertisements will not be tailored to your interest. For more information regarding the cookies that we use, the purposes of the cookies used and for how long the cookies are stored, please see our cookie preference management tool or contact us using the contact details set out above, see Section 12 (Contact Us).

CONTACT INFORMATION TO DATA PROTECTION OFFICER

Please find below contact information to our data protection officers.
UK:
Topgolf Limited, Attn: Privacy Team, Unit 8, Shepperton Business Park, Govett Avenue, England, TW17 8BA

EEA/EU:
Topgolf Sweden AB, Attn: Privacy, Svärdvägen, 11 4tr, SE-182 33 Danderyd, Sweden

NOTICE TO SOUTH KOREAN RESIDENTS

Certain specific privacy rights apply to you if you are a South Korean resident. These are set out in the following sections.

Legal basis for processing
Topgolf processes your personal data pursuant to the legal basis set forth in the “Purposes of processing and legal basis for processing” section of the Notice to European Economic Area/United Kingdom Residents for the purposes stated in Section 2 (Our Use of Personal Data) of this Privacy Notice. In addition to the foregoing, to the degree warranted or permissible under South Korean law, you consent to the processing of your personal data described in this Privacy Notice. In determining whether to additionally use or provide personal data without the data subject’s consent, we consider the following factors:

• Whether the purpose of the additional use or provision is related to the original purpose of collection;
• Whether the additional use or provision is foreseeable in light of the circumstances under which the personal data was collected or the processing practices;
• Whether the additional use or provision unfairly infringes upon the interests of the data subject; and
• Whether necessary measures to secure the safety of the personal data, such as pseudonymization or encryption, have been taken.

Users Younger Than Age 14
Our Websites and Apps are directed to persons in South Korea who are at least fourteen (14) years of age, and we do not knowingly collect any personal data from children in South Korea younger than the age of fourteen (14) years. If a parent or guardian in South Korea is made aware that a child under the age of fourteen (14) years has provided us with personal data through any point of contact, please call us at +1 (833) 554-0955 or write to us at the contact details above, and we will delete the personal data. If we have actual knowledge that personal data about a person in South Korea younger than the age of fourteen (14) years has been collected without parental/guardian consent, then we will take the appropriate steps to delete such personal data.

Destruction of Personal Data
The process and method for destroying personal data are set forth below:
(1) Process of destruction: Topgolf selects the relevant personal data to be destroyed and destroy it with the approval of our Data Protection Officers (“DPO”).
(2) Method of destruction: Topgolf destroys personal data recorded and stored in the form of electronic files by using a technical method (e.g., low level format) to ensure that the records cannot be reproduced, while personal data recorded and stored in the form of paper documents shall be shredded or incinerated.

Details of third parties with whom we share your information
If you are a South Korean resident, you may request information from us about how we may share certain categories of your personal data with third parties. We may provide third parties with personal data as set forth in Section 3 (Our Disclosure of Personal Data) above. For additional information, including about specific parties to which we disclose your personal data, please contact us using the Contact Us information.

Collection and Transfer of Information Overseas
We collect and process personal data outside of Korea in order to provide the Topgolf Offerings. Countries where personal data is collected and processed: United Staes. The Company transfers Personal Information to third parties located outside of Korea as specified in Section 9 (Cross-Border Transfer of Data). If a User does not want the Company to transfer his/her Personal Information overseas, the User can refuse such transfer by not agreeing to the collection or us of Personal Information. However, if a User refuses cross-border transfer of his/her Personal Information, the Company will be unable to provide the User with a part or all of the Services.

Rights of data subjects in relation to his or her personal data
Notwithstanding Section 4 (Your Privacy Choices) of the Privacy Notice, the following provisions will apply to customers located or residing in South Korea. You (and your legal representative) have statutory rights under the PIPA, including the right to access, rectification, erasure, suspension of processing and withdrawal of consent. You (or your legal representative) can exercise such rights by contacting us at the contact details set out above (see Section 12, Contact Us).

Automated Decision-making
For residents of South Korea, we do not use automated decision-making without human intervention, including profiling, in a way that produces legal effects concerning you or otherwise significantly affects you.

Security measures implemented by Topgolf
Notwithstanding Section 7 (Security of Personal Data) of the Privacy Notice, the following provisions will apply to customers located or residing in Korea. Topgolf implements the following technical, managerial, and physical measures necessary to ensure the security of the personal data.
Managerial measures: Designation of a DPO, establishment and implementation of an internal management plan, regular training of employees on protection of personal data, etc.
Technical measures: Management of the right to access the personal data processing system, installation of an access control system, installation of security programs, etc.
Physical measures: Restriction on access to Personal data storage mediums such as the computer room and data storage room, etc.

Collection of Opinions and Handling of Complaints
If you have any questions regarding this Privacy Notice, you may raise your questions with us as detailed above (see Section 12, Contact Us).

NOTICE TO UNITED STATES RESIDENTS

These disclosures supplement the information contained in our Privacy Notice by providing additional information about the privacy rights available to individual residents of certain states in the United States and our personal data processing practices relating to those individuals. For a detailed description of how we collect, use, disclose, and otherwise process personal data, please read our Privacy Notice.

Nevada Residents

Nevada S.B. 220 provides consumers with the ability to opt out of the sale of their personal data. We do not sell your personal data as defined in S.B. 220. However, you may still submit an opt-out request, and if our practices were to change in the future, we would honor your request. If you are a Nevada resident and would like to opt out of the sale of your covered information, your request must be submitted by calling toll-free at (833) 554-0955 or writing to us at the following mailing address: Topgolf, Attn: Privacy Team, 8750 N. Central Expressway, Suite 1200 Dallas, U.S.A. TX 75231. Your request must include your full name, street address, city, state, zip code, and a valid email address so that we can contact you if needed regarding your request. If you previously provided a phone number, including it will assist us in making sure we identify you as someone who wants to opt out. You may be required to take reasonable steps as we determine from time to time to verify your identity and/or the authenticity of your request.

Residents of States with Comprehensive Privacy Laws

We disclose all of the categories of personal data we collect to the categories of recipients set forth in the Our Disclosure of Personal Data section of our Privacy Notice. Our disclosure of personal data to the following categories of third parties qualifies as the sale of personal data or the sharing or processing of personal data for targeted advertising under certain privacy laws:

• Third-Party Advertising and Analytics Providers: Transaction Information; Device Information; Interaction Information; Information about your Interests, Preferences and Performance; demographic data; Photo/Video data and User Generated Content
• Business Partners: Transaction Information; Device Information; Interaction Information; Information about your Interests, Preferences and Performance; demographic data; Photo/Video data and User Generated Content
• Social Media Platforms: Transaction Information; Device Information; Interaction Information; Information about your Interests, Preferences and Performance; demographic data; Photo/Video data and User Generated Content

Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to limit or opt-out of the sale of personal data or the processing of personal data for purposes of targeted advertising (as described in the Your Additional U.S. Privacy Choices section below). Please note we do not sell the personal data of individuals we know to be less than 16 years of age or share such information for targeted advertising purposes.

Sensitive Personal Data

The following personal data elements we collect may be classified as “sensitive” under certain privacy laws:

• Government ID numbers, including social security number, driver’s license number, state identification card number, or passport number.
• Health data, including information regarding an individual’s mental or physical health condition. If you are a person in Washington or Nevada, please see our Washington and Nevada Consumer Health Privacy Notice for additional information.
• Precise geolocation data

We use sensitive personal data for the purposes set forth in the Our Use of Personal Data section of our Privacy Notice. We do not sell sensitive personal data, and we do not process or otherwise share sensitive personal data for the purpose of targeted advertising. However, depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to limit, or withdraw your consent for, our processing of sensitive personal data (as described in the Your Additional U.S. Privacy Choices section below).

Automated Decision-Making and Profiling

We do not conduct automated processing of personal data for the purposes of evaluating, analyzing, or predicting an individual’s personal aspects in furtherance of decisions that produce legal or similarly significant effects. As a result, we do not provide a right to exercise control over such forms of automated decision-making and profiling.

Your Additional U.S. Privacy Choices

Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights:

• Right to Know: The right to confirm whether we are processing personal data about you and, for residents of California and Oregon only, to obtain certain personalized details about the personal data we have collected about you, including: The categories of personal data collected; The categories of sources of the personal data; The purposes for which the personal data were collected; The categories of personal data disclosed to third parties (if any), and the categories of recipients to whom this personal data were disclosed; The categories of personal data shared for targeted advertising purposes (if any), and the categories of recipients to whom the personal data were disclosed for these purposes; The categories of personal data sold (if any) and the categories of third parties to whom the personal data were sold; and For Oregon residents only, a list of specific third parties to whom personal data have been disclosed.
• Right to Access & Portability: The right to obtain access to the personal data we have collected about you and, where required by law, the right to obtain a copy of the personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.
• Right to Correction: The right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of the personal data.
• Right to Control Over Sensitive Personal Data: The right to exercise control over our collection and processing of certain sensitive personal data.
• Right to Control Over Automated Decision-Making / Profiling: The right to direct us not to use automated decision-making or profiling for certain purposes.
• Right to Opt-Out of Targeted Advertising: The right to direct us not to use or share personal data for certain targeted advertising purposes. To disable sharing through cookies set by third parties that may be considered targeted advertising under such laws, please adjust your settings by clicking the link in the footer titled “Manage Cookie Preferences”.
• Right to Opt-Out of Sales: The right to direct us not to sell personal data to third parties, including the right to opt-out of the disclosure of personal data to third parties for the third parties’ direct marketing purposes under California’s “Shine the Light” Law.
• Right to Deletion: The right to have us delete personal data we maintain about you.
• Right to Appeal: The right to submit an appeal regarding our decision about your request. You can do so by submitting this form. Please include your full name, the basis for your appeal, and any additional information to consider.

Depending on your state of residency, you may also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights. However, the exercise of the rights described above may result in a different price, rate or quality level of product or service where that difference is reasonably related to the impact the right has on our relationship or is otherwise permitted by law.

Submitting Privacy Rights Requests

Please submit a request specifying the right you wish to exercise by:

• Completing our form found here; or
• Calling our toll-free U.S. telephone number: (833) 554-0955.

To exercise your right to opt-out as it relates to the use of cookies and related technologies that involve the sale of personal data or the use of personal data for targeted advertising purposes, please click the “Manage Cookies” link in the footer of the website and adjust your preferences accordingly. If you are visiting our site with the Global Privacy Control enabled, any cookies that constitute sales or are used for targeted advertising should already be turned off automatically in our cookie preference manager. Please note this opt-out tool is website, device, and browser specific, so you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting. You may also follow the other steps set forth in the Automatic Data Collection Preferences and Targeted Advertising Preferences section of the Your Privacy Choices section of our Privacy Notice to further exercise control over automatic data collection technologies.

Before processing your request to exercise certain rights (including the Right to Know, Access & Portability, Correction, and Deletion), we will need to verify your identity and confirm you are a resident of a state that offers the requested right(s). As a result, we require requests submitted through our online form and toll-free number to include first and last name, email address, phone number, state of residency, zip code and information about your history with us. If we are unable to verify that the individual submitting the request is the same individual about whom we have collected information (or someone authorized by that individual to act on their behalf), we will not be able to process the request.

Submitting Authorized Agent Requests

If you are an authorized agent submitting a request on a user’s behalf, please complete the applicable request per the instructions below. You may also make a request on behalf of your minor child. We will follow up to request a signed, written permission signed by the individual who is the subject of the request authorizing you to make the request on their behalf. The written permission must state your full legal name, the full legal name of the individual who is the subject of the request and needs to be clear about the permission granted. Alternatively, you may submit a copy of a power of attorney under Probate Code sections 4000-4465. In either case, please also indicate the nature of your request. The consumer’s identity, in addition to your own, will need to be independently verified in order for us to be able to fulfill your request. Depending on the evidence provided and your state of residency, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.

Additional California-Specific Disclosures

California Categories of Personal Data: California law requires we provide disclosures to you about what personal data we collect by reference to the enumerated categories of personal data set forth within California law. To address this obligation, we have identified the relevant enumerated California personal data category for the personal data described in the Our Collection and Use of Personal Data section of our Privacy Notice below:

• Identifiers, such as name, contact information, and online or device identifiers.
• Protected classification characteristics, such as age, sex (including gender), national origin, citizenship, and marital status.
• Commercial information, such as payment information you provide for goods, services, customer service records, and information about the products you have purchased.
• Internet / network information, such as information about the web browser and operating system you are using, the website or ad that referred you to the Topgolf Offerings, areas of the Topgolf Offerings that you visited, and terms entered into a search engine that led you to the Topgolf Offerings.
• Geolocation data, such as specific location, e.g., longitude/latitude coordinates from a global positioning system (GPS).
• Sensory information, such as images, video, or audio recordings
• Professional / employment information, such as current and past employers.
• Sensitive personal data, such as government ID numbers, health data, and precise geolocation data.
• Inferences, such as your perceived interests, preferences, characteristics or behavior.

The personal data we collect about you will depend upon how you use the Topgolf Offerings or otherwise interact with us. Accordingly, we may not collect all of the information above about you.

California’s “Shine the Light” Law: California’s “Shine the Light” law (Civil Code Section §1798.83) provides certain rights to California residents that have an established business relationship with us with regard to the disclosure of certain types of personal data to third parties for their direct marketing purposes. It is company policy that we do not disclose personal data to third parties for their direct marketing purposes if a consumer has exercised their right to opt out. To opt out of having your personal data disclosed to third parties for their direct marketing purposes, please follow the instructions for opting out of targeted advertising and personal data sales (above).

Notice of Financial Incentive: Under California regulation, certain programs we offer that provide benefits to consumers may be considered financial incentive or loyalty programs. We may collect personal data from you in connection with these programs, for example contact information (name, email address, residential address) and certain commercial information for a number of reasons, including to administer the program, contact you with regard to your account (if any), to provide the benefits to you, to better serve you, and to fulfill your requests associated with the program. The third parties that may receive access to your personal data in connection with any program or offering are our program partners. To the extent that we provide a program that may be considered a financial incentive because the program is directly or reasonably related the collection, deletion or sale or retention of consumer personal data, we have determined the value is reasonably related to the overall value we receive from the personal data participants provide specific to the program, based on our reasonable but sole determination. We estimate the value of the personal data we would receive and otherwise process in connection with these programs and offerings by considering the expense we would incur in collecting and processing the personal data, as well as the expenses related to facilitating the program or offering. To opt into the programs, you may need to provide certain information, register for an account and agree to the applicable program terms, or otherwise follow the instructions associated with that applicable program. Please also see the terms of the program you are joining for additional description of the program and any additional requirements. Participation in our programs is voluntarily, and you can withdraw at any time by following the instructions provided in connection with each offering or calling (833) 554-0955.

WASHINGTON AND NEVADA CONSUMER HEALTH DATA PRIVACY NOTICE

Last Updated: May 13, 2026

This Consumer Health Data Privacy Notice (the “Consumer Health Notice”) applies to residents of Washington State and Nevada and individuals whose Consumer Health Data (as defined below) is collected in Washington State and Nevada by us through any of our Websites or the related content, products, services, platforms and other functionality offered on or through the Topgolf Offerings. This Consumer Health Notice supplements the Privacy Notice set forth above and explains how we use and disclose your Consumer Health Data. This Consumer Health Notice does not address privacy practices relating to Topgolf job applicants, employees, or other personnel. Please note that this Consumer Health Notice is not a contract and does not create any legal rights or obligations not otherwise provided by law. Changes to this Consumer Health Notice will be made according to the process described in Section 13, Changes in our Privacy Notice, above.

a. Our Collection and Use of Consumer Health Data

The term “Consumer Health Data” as used in this Consumer Health Notice means any personal data that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status as defined in the Washington My Health My Data Act or the Nevada Consumer Health Data Privacy Law (collectively, the “Laws”). Consumer Health Data does not include information that is considered deidentified under the MHMD Act. Additionally, Consumer Health Data does not include Protected Health Information (as defined by HIPAA). The data we collect depends on the context of your interactions with us and, in most cases, is information that you decide to share with us. Consumer Health Data does not include information that is considered deidentified under the Laws. Examples of Consumer Health Data that Topgolf may collect include: Information you share about your health-related conditions, symptoms, experiences, diagnoses, accessibility requirements, testing, or treatments. Golf performance information, including swing data.

We may process Consumer Health Data that we collect from you by methods including, but not limited to, collecting, using, storing, organizing, combining, erasing, filtering, and transmitting data in accordance with this Consumer Health Notice. With your permission, we may process and/or use Consumer Health Data that we collect from you to deliver the Topgolf Offerings to you, including for the following purposes: To fit you for products. To provide accessible accommodations. To provide emergency services if applicable. To create anonymous, aggregated, or de-identified data.

b. Sources of Consumer Health Data

The Consumer Health Data we collect depends on the context of your interactions with the Topgolf Offerings and, in most cases, is information that you decide to share with us.

c. Our Disclosure of Consumer Health Data

We may share the categories of Consumer Health Data set forth above with the following third parties:

• Service Providers: We work with a variety of service providers who help us process your Consumer Health Data, such as to facilitate the operation of our Websites and the Topgolf Offerings.
• Business Transactions: We may take part in or be involved with a business transaction, such as a merger. We may disclose Consumer Health Data to a third-party during the negotiation of or in connection with such a transaction but, to the extent permitted by applicable law, we will only disclose Consumer Health Data upon the third party agreeing to the same or stronger protections for your Consumer Health Data than are set forth in this Consumer Health Notice.
• Legal Obligations and Rights: We may disclose Consumer Health Data to third parties: in connection with the establishment, exercise, or defense of legal claims; to comply with laws or to respond to lawful requests and legal processes; to protect our rights and property and the rights and property of others, including to enforce our agreements and policies; to detect, suppress, or prevent fraud; to protect the health and safety of us and others; or as otherwise required by applicable law.
• With Your Consent: We may disclose Consumer Health Data about you to certain other third parties or publicly with your consent or at your direction.

d. Your Privacy Rights

The Laws provide the following rights with respect to Consumer Health Data we collect about you:

• Right to Access / Confirm: You may have the right to confirm whether we are collecting, sharing, or selling Consumer Health Data about you and with whom we may be disclosing such Consumer Health Data, and to access such data.
• Right to Withdraw Consent: If you have provided your consent for our processing or sharing of your Consumer Health Data, you may have the right to withdraw your consent.
• Right to Delete: You may have the right to request that we delete your Consumer Health Data and that all third parties to whom we have disclosed your Consumer Health Data delete such data.

To exercise any of the privacy rights set forth above or to review or request changes to data, please submit a request by: Calling us at (833) 554-0955, or clicking “Your Privacy Choices” in the footer of our Website. Before processing your request, we will need to authenticate your identity. To authenticate your identity, we will generally require matching a minimum amount of information you provide us with the information we maintain about you in our systems. This process may require us to request additional information from you, including, but not limited to, your email address and phone number. In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to authenticate your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will explain the reasons for our decision. If your request to exercise a right under the Laws is denied, you may appeal that decision by contacting us. If the appeal is unsuccessful, you may raise a concern or lodge a complaint with the applicable attorney general: Washington: www.atg.wa.gov/file-complaint ; Nevada: ag.nv.gov/Complaints/File_Complaint/

e. Changes to This Consumer Health Notice

This Consumer Health Notice is current as of the Last Updated date set forth above. We may change this Consumer Health Notice from time to time, so please be sure to check back periodically. We will post any changes to this Consumer Health Notice on our Websites.